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DETAILED ACTION 

Response to Arguments 

1. In response to communications filed on 6/19/2008, the following claims 1, 3, 23, 30, and 
32; cancels claim 36, and adds claims 44-48. The following claims 1-5, 7-14, 23-30, 32-35, and 
37-48 are pending and are presented for examination. 

1 . 1 Applicant's arguments, see pages 10-16, filed on 10/29/2007, with respect to the rejection 
of the claims have been fully considered and they are persuasive as amended. 

EXAMINER'S AMENDMENT 

2. An examiner's amendment to the record appears below. Should the changes and/or 
additions be unacceptable to applicant, an amendment may be filed as provided by 37 CFR 
1.312. To ensure consideration of such an amendment, it MUST be submitted no later than the 
payment of the issue fee. 

Authorization for this examiner's amendment was given in a telephone interview with 
Michael J. Donahue on September 12, 2008. 

The apphcation has been amended as follows: 

Claims 36-38 and 44 should be replaced by the following claims. 

36. (Canceled) 

37. (Currently amended) The article of manufacture of claim M> 30 wherein said stop 
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condition is an expiration time. 

38. (Currently amended) The article of manufacture of claim ^ 30 wherein said stop 
condition is based on network traffic conditions. 

44. (New) A method for intrusion detection in a network comprising: 

receiving indication of a possible network intrusion; 

selecting one of a plurality of computers in the network to become an intrusion detection 
platform, wherein selecting one of the plurality of computers is based on the indication of a 
possible network intrusion; 

sending a request from a central server to the selected computer to install and execute 
intrusion detection software, wherein the request is sent in response to the received indication of 
the possible network intrusion; and 

sending a message to the selected computer to cease execution of the intrusion detection 
software when a stop condition is detected, wherein the stop condition includes a condition that 
no intrusion has been detected for a period of time. 

Allowable Subject Matter 

3. Claims 1-5, 7-14, 23-30, 32-35, and 37-48 are allowed. 

Conclusion 

4. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to CARL COLIN whose telephone number is (571)272-3862. The 
examiner can normally be reached on Monday through Thursday, 8:00-6:30 PM. 
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If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Nasser G. Moazzami can be reached on 571-272-4195. The fax phone number for 
the organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an apphcation may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would 
like assistance from a USPTO Customer Service Representative or access to the automated 
information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 

/Carl Colin/ 

Primary Examiner, Art Unit 2136 
September 12, 2008 



